Apolitical Analysis Suggests Improved Patching Practices for Election Security
In a political atmosphere rife with contentious debates, particularly surrounding former President Donald Trump’s unfounded allegations of widespread voter fraud related to the 2020 presidential election, one document has emerged as a breath of fresh air, capturing bipartisan support even from critics of the Trump administration. This document is a newly declassified report from the Cybersecurity and Infrastructure Security Agency (CISA), which addresses the increasingly vital issue of election security.
The report, which has garnered attention amidst a torrent of political discourse, appears to provide a balanced perspective on the state of cybersecurity within election infrastructure. Experts in the field have responded positively, with Nick Leiserson, former member of the Biden administration’s Office of the National Cyber Director, acknowledging its merit. “It’s pretty reasonable… It’s sensible advice. So, that’s good,” he stated, highlighting the report’s potential to contribute constructively to a challenging topic.
The foundation for the report is built upon data collected from various voluntary security assessments, spanning from 2019 to 2024. These assessments, conducted by seasoned CISA staff, involved sophisticated techniques such as static and dynamic code analysis and penetration testing. This comprehensive methodology is seen as a boon for the election administration community, with Geoff Hale, a systems engineer formerly leading CISA’s election security efforts, attesting to its professional integrity. Hale remarked that the recommendations do not carry a political bias and acknowledged the room for improvement in the outlined practices.
Balancing Transparency and Trust
A significant feature of the CISA report is its unprecedented level of candor regarding the cybersecurity landscape of voting machine software and the networks employed by state and local governments for record-keeping. Leiserson commended the report for its explicit nature, stating, “I don’t remember seeing anyone put it that explicitly in a government report before, and kudos for doing so.” However, this openness presents a double-edged sword, as pointed out by Hale. The transparency surrounding vulnerabilities typically reserved for closed discussions with election officials now publicly exposes potential weaknesses without prior notification. Hale articulated concern regarding the timing of the report’s release, which may have left election officials feeling blindsided.
Trust between the election community and CISA had been cultivated through previous engagements, with election officials permitting vulnerability assessments and penetration testing. The absence of prior communication regarding the report could undermine this trust, raising questions about ongoing collaboration in the future.
Officials from CISA have opted to refrain from commenting on the details of the report. However, Acting CISA Director Nick Andersen reaffirmed the agency’s commitment to bolstering support for state and local election officials to safeguard election infrastructure and protect the democratic process.
Challenges with Vulnerabilities and Certification
The report identifies that election-related software, akin to other IT systems, is susceptible to vulnerabilities that necessitate prompt remedial actions. However, election technology faces unique challenges. One primary issue arises from the requirement for voting machines to be certified by state governments, each with its own regulations on how vendors can implement updates. This certification process is often prolonged due to the need for thorough testing and verification of security patches, leading to lengthy periods during which updates are prohibited.
Additionally, the report underscores the "inconsistent vulnerability disclosure practices" exhibited by voting machine vendors, which contributes to the issue of some election systems being deployed with known and unaddressed security flaws. The report also shines a light on the security gaps within the networks utilized by state and local governments for election record management. In theory, voting machines are meant to be air-gapped, meaning they should not be connected to the internet, yet this is frequently not the case in practice.
This discrepancy reflects the mismatch between the security assumptions of manufacturers’ threat models and the operational realities of running complex election systems. Leiserson pointed out that it was commendable for the report to address these practical concerns directly, illustrating the need for a harmonized approach to cybersecurity.
The Path Forward
The report proposes standardizing patch management and certification protocols for voting systems and related infrastructure to enable real-time cybersecurity adaptations without hindering certification processes. However, the implementation of these recommendations rests with the states. While the U.S. Election Assistance Commission sets certification standards, it is crucial for individual states to adopt and endorse these measures.
Further complicating this landscape is the recent dismissal of key members of the Election Assistance Commission by Trump, leaving critical technical standards in limbo until new commissioners can sign off on potential revisions. Leiserson emphasized the necessity for state legislation and political leadership to reformulate and harmonize these standards, suggesting that such changes are unlikely to take effect before upcoming elections.
As the debate continues around election integrity and cybersecurity, the insights generated by the CISA report present a promising framework to enhance election security protocols, underscoring the importance of collaborative efforts among stakeholders to promote a secure electoral process. The path to achieving these goals may be fraught with political complexity, but the need for enhanced cybersecurity practices remains undeniable.